CVE-2026-112902 Python Pillow CVE debrief

Who should care

Defenders responsible for image processing applications using Pillow, especially those re-saving images as TIFF, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-112902 is a vulnerability in Pillow that can cause memory disclosure or segfaults when saving crafted TIFF files. Defenders should prioritize verifying exposure in image processing applications, especially those using Pillow to save images as TIFF, and assess the impact of potential memory disclosure or process crashes.

• Potential memory disclosure leading to sensitive data exposure
• Potential process crashes or denial of service
• Need to verify exposure in image processing applications
• Prioritize updating Pillow to version 13.0.0 or later

Technical summary

The vulnerability is in `PyImaging_LibTiffEncoderNew` in `src/encode.c`. A crafted TIFF file can cause Pillow to disclose memory or segfault when saving as TIFF. The trigger is an ordinary `Image.open()` followed by a bare `im.save(fp, 'TIFF')`. This issue allows an attacker to potentially disclose sensitive information or cause a denial of service through a specially crafted TIFF file. The vulnerability affects applications that re-save images as TIFF, and defenders should prioritize verifying exposure in such applications.

Defensive priority

Defenders should prioritize verifying exposure in image processing applications, especially those using Pillow to save images as TIFF, and assess the impact of potential memory disclosure or process crashes.

Recommended defensive actions

• Verify if applications using Pillow to save images as TIFF are exposed to this vulnerability.
• Assess the impact of potential memory disclosure or process crashes in affected applications.
• Prioritize updating Pillow to version 13.0.0 or later.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The source corpus provides details on a crafted TIFF file causing memory disclosure or segfault in Pillow when saving as TIFF. A reproducer was provided, demonstrating the issue with a 356-byte LZW TIFF file.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.